OAM: Enable White Listing mode

                       We are going to cover about the commands that can be used to enable White listing of URLs in OAM and enable it on OAM Protected applications. This white listing of URLs helps to avoid re-directions to external sites/URLs that are not registered with OAM.

Environment:

• OAM 11.1.2.3BP07
• RHEL6/OEL6

Steps:

      Enabling and configuring White-listing  mode is very simple and just requires the following acitivites.

1. Enable OAM White listing Mode
2. Adding/Removing URLs to/from the list of White listed URLs

1. Enable OAM White listing Mode:

• Login to the server that contains installation of OAM component
• Browse to the following directory
• <Oracle_IDM_Home>/common/bin
• Execute the following commands
• ./wlst.sh
• connect('weblogic','password','t3://oamhost:7001'>)
• domainRuntime()
• oamSetWhiteListMode(oamWhiteListMode="true")
• This returns the success message as shown below.

2. Adding/Removing URLs to/from the list of White listed URLs :

• Execute the below command to add a URL to the list
• oamWhiteListURLConfig(Name="google",Value="http://www.google.com",Operation="Update")  

• Execute the below command to remove a URL from the list
• oamWhiteListURLConfig(Name="google",Value="http://www.google.com",Operation="Remove") 

Validation:

• We can validate the behaviour during the logout process of any protected application with OAM Logout URL. For example, Add a URL like "http://www.google.com/" to white list and  invoke the following Logout URL which has end_url parameter with the google.com URL
• http://<OHSHost:7777/oamsso/logout.html?end_URL=http://www.google.com/
• After successful logout, above URL will redirect you back to "http://www.google.com/" as it is trusted URL.
• You can validate by removing the same URL from the White Listed URLs list and invoke logout again. Then OAM will just log you out but will not redirect the user to "http://www.google.com/"

Thanks for visiting.

OAM: Storage not configured error in Session Management

               Receiving "Storage not configured" error popup in OAM console while accessing user session management information.  

Environment:

• OAM 11.1.2.3 BP07
• RHEL6/OEL6
• OUD 11.1.2.3

Cause:

OAM Console throws "Storage not configured" error due to couple of reasons. This might happen

• If there is no single OAM managed server up and running.
• When Admin server failed to initialize session manager with the following exception in Admin logs

<Oct 12, 2016 7:06:41 PM EDT> <Warning> <oracle.oam.admin.console.policy> <BEA-000000> <Exception in getting sessionmanager
oracle.security.am.engines.sme.exceptions.ManagerNotCreatedException: OAMSSA-02008: Cannot instantiate the persistence access implementation for class PersistedSessionCache.
        at oracle.security.am.engines.sme.mgr.AbstractSessionManager.handleInstantiationFailure(AbstractSessionManager.java:325)
        at oracle.security.am.engines.sme.mgr.AbstractSessionManager.<init>(AbstractSessionManager.java:306)
        at oracle.security.am.engines.sme.mgr.SessionManagerImpl.<init>(SessionManagerImpl.java:51)
        at oracle.security.am.engines.sme.mgr.SessionManagerImpl.getInstance(SessionManagerImpl.java:66)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at oracle.security.am.engines.sme.SessionManagerFactory.getManager(SessionManagerFactory.java:281)
        at oracle.security.am.engines.sme.SessionManagerFactory.readObject(SessionManagerFactory.java:207)
        at oracle.security.am.engines.sme.SessionManagerFactory.getSessionManager(SessionManagerFactory.java:95)
        at model.SessionSearchVOImpl.executeSMESearch(SessionSearchVOImpl.java:410)
        at model.SessionSearchVOImpl.retrieveResultSet(SessionSearchVOImpl.java:602)
        at model.SessionSearchVOImpl.executeQueryForCollection(SessionSearchVOImpl.java:324)
        at oracle.jbo.server.ViewRowSetImpl.execute(ViewRowSetImpl.java:1282)
        at oracle.jbo.server.ViewRowSetImpl.executeQueryForMasters(ViewRowSetImpl.java:1509)
        at oracle.jbo.server.ViewRowSetImpl.executeQueryForMode(ViewRowSetImpl.java:1415)
        at oracle.jbo.server.ViewRowSetImpl.executeQuery(ViewRowSetImpl.java:1400)
        at oracle.jbo.server.ViewObjectImpl.executeQuery(ViewObjectImpl.java:7672)
        at oracle.adf.model.bc4j.DCJboDataControl.executeIteratorBinding(DCJboDataControl.java:1346)
        at oracle.adf.model.binding.DCIteratorBinding.doExecuteQuery(DCIteratorBinding.java:2265)

Fix:

Following actions can help in the fixing the issue.

• Make sure to start the OAM Managed server before accessing the Session Management information through OAM Admin console
• If the above action doesn't work, Restart the OAM Admin Server(Weblogic Admin Server) again after having the OAM Managed server Up and Running.

Thank you for visiting.

OIF: Encrypt SAML Assertions

               Today we are going to learn about the configurations required to enable encrypted SAML communication between IDP and SP. In my earlier posts, I have covered about SSO configurations and couple of other scenarios in Federated SSO by taking Salesforce as example. You can refer to my earlier posts for more information.

              This post specifically covers about configuration required to enable Encryption of SAML Assertion. Assuming we already have configured SSO to Service Provider application in SP Initiated mode which is Salesforce in our example.

 Environment:

• OAM 11.1.2.3BP07
•  Salesforce
• RHEL6/OEL6 

Steps:

• In this post, we are going to use the Self-Signed Certificate that can be generated inside Salesforce. In real environments, we usually get these certificates signed by third party certificate authority.
• Lets login to Salesforce application to create a Self-Signed certificate
• Go to Setup ->  Ceritificates and Key management 
• Click on Create Self-Signed Certificate to create new certificate if there is no existing certificate

 

• Once the certificate is created, Lets configure the IDP Profile to configure the encryption settings.
• Navigate to Setup and search for Single Sign-on settings
• Update the following options
• Request Signature method -> RSA-SHA1
• Assertion Decryption Certificate -> Select the previously created self-signed certificate

•  Save the Changes and Download the metadata file

• If you compare this latest downloaded metadata with earlier, this will have additional information about the encryption information.

•  Now we need to import this latest metadata into Identity Provider which is OIF
• Login to OAM Console and Go to Federation -> Identity Provider Administration
• Open 'Salesforce' service provider profile
• Click on 'Load metadata' to import this new metadata configuration

• Go to Advanced section and check the 'Encrypt Assertion' setting

• Save the changes made to this service provide profile.
• Ok. We are now finished with the configuration changes. Let's validate the Encryption now.

Validation: 

• Access the Salesforce application using the SP initiated URL.
• https://<mydomain>.my.salesforce.com
• This will redirect to the IDP Url to authenticate against IDP
• Provide the login credentials and click on Submit to login
•  Once the authentication is successful, OIF engine generates SAML Response in encrypted manner as shown below. You can view this SAML messages using the browser plugins.

 

• Once the Assertion is successfully decrypted and validated by Salesforce, you will be landed into your Salesforce domain. 

Thank you for visiting.